Cybersecurity firm LetzSecure uncovered an active quishing campaign targeting drivers using paid parking across Luxembourg City.
Fraudulent stickers reading “Scannez et Payez” have been placed on parking meters throughout the capital. Scanning the QR code redirects victims to a fake site mimicking a payment service called “ParkPay” — completely unrelated to the official Indigo Neo app used by the City of Luxembourg.
The site replicates a full payment flow: license plate entry, duration selection, then a credit card form designed to harvest card numbers, expiry dates, and CVV codes in real time.
LetzSecure identified affected meters on April 27, 2026, on Avenue de la Faïencerie, Rue Jean l’Aveugle, Rue Alfred de Musset, and Boulevard Joseph II. The City of Luxembourg, CIRCL, and the Grand Ducal Police have been notified.
If you park in Luxembourg City: only use the official Indigo Neo app. Never scan a QR code on a parking meter.
Full technical analysis: letzsecure.com
